Securing EVM Smart Contracts: Defending Against Reentrancy and State Pitfalls

1. The Anatomy of Reentrancy

Reentrancy remains one of the most destructive attack vectors in EVM smart contract history. It occurs when an external contract call hands control back to an untrusted recipient before the calling contract updates its internal state balances.

When the malicious contract receives control (via fallback or receive functions), it recursively calls the original contract's withdrawal function, draining funds repeatedly.

// INSECURE PATTERN: Interacting before updating state
function withdraw(uint256 amount) external {
    require(balances[msg.sender] >= amount, "Insufficient");
    (bool sent, ) = msg.sender.call{value: amount}(""); // Vulnerability here!
    require(sent, "Transfer failed");
    balances[msg.sender] -= amount;
}

2. The Checks-Effects-Interactions (CEI) Standard

The foundational defense against reentrancy is the Checks-Effects-Interactions pattern. Always perform all authorization checks first, update internal state variables second, and only then make external calls to external addresses or contracts.

// SECURE PATTERN: Checks-Effects-Interactions (CEI)
function withdrawSecure(uint256 amount) external nonReentrant {
    // 1. CHECKS
    require(balances[msg.sender] >= amount, "Insufficient balance");

    // 2. EFFECTS (Update state before external transfer)
    balances[msg.sender] -= amount;

    // 3. INTERACTIONS
    (bool sent, ) = msg.sender.call{value: amount}("");
    require(sent, "Transfer failed");
}

3. Storage Layout & Gas Profiling

Every 32-byte storage slot in the EVM costs significant gas to read (SLOAD) and write (SSTORE). By packing related uint128, uint64, or boolean variables into consecutive positions within a struct, multiple state mutations can be committed within a single storage write slot.

Combining defensive modifiers like OpenZeppelin's ReentrancyGuard with optimized storage layout guarantees both ironclad security and competitive gas efficiency for protocol users.